elementor / vendor_prefixed / twig / src / Extension / SandboxExtension.php

SandboxExtension.php in Elementor Website Builder – more than just a page builder 3.28.0-dev1, at vendor_prefixed/twig/src/Extension/SandboxExtension.php

151 lines 5.0 KB

Raw Download Zip

1	<?php
2
3	/*
4	* This file is part of Twig.
5	*
6	* (c) Fabien Potencier
7	*
8	* For the full copyright and license information, please view the LICENSE
9	* file that was distributed with this source code.
10	*/
11	namespace ElementorDeps\Twig\Extension;
12
13	use ElementorDeps\Twig\NodeVisitor\SandboxNodeVisitor;
14	use ElementorDeps\Twig\Sandbox\SecurityNotAllowedMethodError;
15	use ElementorDeps\Twig\Sandbox\SecurityNotAllowedPropertyError;
16	use ElementorDeps\Twig\Sandbox\SecurityPolicyInterface;
17	use ElementorDeps\Twig\Sandbox\SourcePolicyInterface;
18	use ElementorDeps\Twig\Source;
19	use ElementorDeps\Twig\TokenParser\SandboxTokenParser;
20	final class SandboxExtension extends AbstractExtension
21	{
22	private $sandboxedGlobally;
23	private $sandboxed;
24	private $policy;
25	private $sourcePolicy;
26	public function __construct(SecurityPolicyInterface $policy, $sandboxed = \false, ?SourcePolicyInterface $sourcePolicy = null)
27	{
28	$this->policy = $policy;
29	$this->sandboxedGlobally = $sandboxed;
30	$this->sourcePolicy = $sourcePolicy;
31	}
32	public function getTokenParsers() : array
33	{
34	return [new SandboxTokenParser()];
35	}
36	public function getNodeVisitors() : array
37	{
38	return [new SandboxNodeVisitor()];
39	}
40	public function enableSandbox() : void
41	{
42	$this->sandboxed = \true;
43	}
44	public function disableSandbox() : void
45	{
46	$this->sandboxed = \false;
47	}
48	public function isSandboxed(?Source $source = null) : bool
49	{
50	return $this->sandboxedGlobally \|\| $this->sandboxed \|\| $this->isSourceSandboxed($source);
51	}
52	public function isSandboxedGlobally() : bool
53	{
54	return $this->sandboxedGlobally;
55	}
56	private function isSourceSandboxed(?Source $source) : bool
57	{
58	if (null === $source \|\| null === $this->sourcePolicy) {
59	return \false;
60	}
61	return $this->sourcePolicy->enableSandbox($source);
62	}
63	public function setSecurityPolicy(SecurityPolicyInterface $policy)
64	{
65	$this->policy = $policy;
66	}
67	public function getSecurityPolicy() : SecurityPolicyInterface
68	{
69	return $this->policy;
70	}
71	public function checkSecurity($tags, $filters, $functions, ?Source $source = null) : void
72	{
73	if ($this->isSandboxed($source)) {
74	$this->policy->checkSecurity($tags, $filters, $functions);
75	}
76	}
77	public function checkMethodAllowed($obj, $method, int $lineno = -1, ?Source $source = null) : void
78	{
79	if ($this->isSandboxed($source)) {
80	try {
81	$this->policy->checkMethodAllowed($obj, $method);
82	} catch (SecurityNotAllowedMethodError $e) {
83	$e->setSourceContext($source);
84	$e->setTemplateLine($lineno);
85	throw $e;
86	}
87	}
88	}
89	public function checkPropertyAllowed($obj, $property, int $lineno = -1, ?Source $source = null) : void
90	{
91	if ($this->isSandboxed($source)) {
92	try {
93	$this->policy->checkPropertyAllowed($obj, $property);
94	} catch (SecurityNotAllowedPropertyError $e) {
95	$e->setSourceContext($source);
96	$e->setTemplateLine($lineno);
97	throw $e;
98	}
99	}
100	}
101	public function ensureToStringAllowed($obj, int $lineno = -1, ?Source $source = null)
102	{
103	if (\is_array($obj)) {
104	$this->ensureToStringAllowedForArray($obj, $lineno, $source);
105	return $obj;
106	}
107	if ($this->isSandboxed($source) && \is_object($obj) && \method_exists($obj, '__toString')) {
108	try {
109	$this->policy->checkMethodAllowed($obj, '__toString');
110	} catch (SecurityNotAllowedMethodError $e) {
111	$e->setSourceContext($source);
112	$e->setTemplateLine($lineno);
113	throw $e;
114	}
115	}
116	return $obj;
117	}
118	private function ensureToStringAllowedForArray(array $obj, int $lineno, ?Source $source, array &$stack = []) : void
119	{
120	foreach ($obj as $k => $v) {
121	if (!$v) {
122	continue;
123	}
124	if (!\is_array($v)) {
125	$this->ensureToStringAllowed($v, $lineno, $source);
126	continue;
127	}
128	if (\PHP_VERSION_ID < 70400) {
129	static $cookie;
130	if ($v === $cookie ?? ($cookie = new \stdClass())) {
131	continue;
132	}
133	$obj[$k] = $cookie;
134	try {
135	$this->ensureToStringAllowedForArray($v, $lineno, $source, $stack);
136	} finally {
137	$obj[$k] = $v;
138	}
139	continue;
140	}
141	if ($r = \ReflectionReference::fromArrayElement($obj, $k)) {
142	if (isset($stack[$r->getId()])) {
143	continue;
144	}
145	$stack[$r->getId()] = \true;
146	}
147	$this->ensureToStringAllowedForArray($v, $lineno, $source, $stack);
148	}
149	}
150	}
151